ES Memory Breaker Configuration

Elastic Stack Elasticsearch
1

Hello all,

We are running Graylog server v1.01 and Graylog-web-interface v1.01on ES v1.4.4 on SLES 11 SP3 platform, today we logon graylog-web-interface and found HTTP 400 error,

the ES logs as below:

[2015-07-03 10:03:03,415][WARN ][indices.breaker ] [FIT CN ES Node] [FIELDDATA] New used memory 646251060 [616.3mb] from field [timestamp] would be larger than configured breaker: 633785548 [604.4mb], breaking
[2015-07-03 10:03:03,443][WARN ][indices.breaker ] [FIT CN ES Node] [FIELDDATA] New used memory 646253680 [616.3mb] from field [timestamp] would be larger than configured breaker: 633785548 [604.4mb], breaking
[2015-07-03 10:03:03,449][WARN ][indices.breaker ] [FIT CN ES Node] [FIELDDATA] New used memory 646252426 [616.3mb] from field [timestamp] would be larger than configured breaker: 633785548 [604.4mb], breaking
[2015-07-03 10:03:03,455][WARN ][indices.breaker ] [FIT CN ES Node] [FIELDDATA] New used memory 646251888 [616.3mb] from field [timestamp] would be larger than configured breaker: 633785548 [604.4mb], breaking
[2015-07-03 10:03:03,785][WARN ][indices.breaker ] [FIT CN ES Node] [FIELDDATA] New used memory 651460534 [621.2mb] from field [timestamp] would be larger than configured breaker: 633785548 [604.4mb], breaking
[2015-07-03 10:03:05,902][WARN ][indices.breaker ] [FIT CN ES Node] [FIELDDATA] New used memory 649663091 [619.5mb] from field [timestamp] would be larger than configured breaker: 633785548 [604.4mb], breaking
[2015-07-03 10:03:06,489][WARN ][indices.breaker ] [FIT CN ES Node] [FIELDDATA] New used memory 646252146 [616.3mb] from field [timestamp] would be larger than configured breaker: 633785548 [604.4mb], breaking
[2015-07-03 10:03:06,533][WARN ][indices.breaker ] [FIT CN ES Node] [FIELDDATA] New used memory 646251688 [616.3mb] from field [timestamp] would be larger than configured breaker: 633785548 [604.4mb], breaking

we think that's the ES memory breaker setting as below link described:
https://www.elastic.co/guide/en/elasticsearch/reference/1.4/index-modules-fielddata.html

we have some questions:

which parameters should be responsible for our ES error, i mean which parameter we should be change and change to which value?
as ES documents mentioned, all parameter already have default value so why we still have encountered this error ?
Thanks for your great support.

2

ES parameters are not "responsible". I mean that you should not really try to change parameters but may be provide more memory than what you set for now.

How much RAM is allocated to ES_HEAP?

3

Hello dadoonet,

We reboot the ES node and set the ES_HEAP_SIZE to 9GB then problem solved, thanks for your help.

B.R
Yan da